@dailephd/my-dev-kit-lab 0.6.2 → 0.7.0

package/dist/src/experiments/plugins/incrementalChangeStaleness/plugin.js

@@ -7,10 +7,10 @@ import { toAffectedNeighborhoodMetricValues } from "../../../evaluation/affected
 import { sanitizePathSegment } from "../../outputPaths.js";
 import { summarizeExperimentRun } from "../../results.js";
 import { defaultIncrementalChangeStalenessConfig, incrementalChangeStalenessConfigDefinition, validateIncrementalChangeStalenessConfig } from "./config.js";
-import { DEFAULT_INCREMENTAL_CHANGE_STALENESS_RUNTIME_ROOT_RELATIVE, INCREMENTAL_CHANGE_STALENESS_TREATMENT_IDS, removeIncrementalChangeStalenessRuntimeRoot } from "./disposableTarget.js";
-import { executeIncrementalChangeStalenessScenario } from "./execution.js";
-import { buildIncrementalChangeStalenessExecutionArtifact, writeIncrementalChangeStalenessExecutionArtifact } from "./executionArtifact.js";
-import { prepareIncrementalChangeStalenessScenarioLifecycle } from "./lifecycle.js";
+import { DEFAULT_INCREMENTAL_CHANGE_STALENESS_RUNTIME_ROOT_RELATIVE, INCREMENTAL_CHANGE_STALENESS_V2_TREATMENT_IDS, INCREMENTAL_CHANGE_STALENESS_V2_TREATMENT_INTENTS, removeIncrementalChangeStalenessRuntimeRoot } from "./disposableTarget.js";
+import { buildIncrementalChangeStalenessExecutionArtifactV2, writeIncrementalChangeStalenessExecutionArtifactV2 } from "./executionArtifactV2.js";
+import { executeIncrementalChangeStalenessScenarioV2 } from "./executionV2.js";
+import { prepareIncrementalChangeStalenessScenarioLifecycleV2 } from "./lifecycleV2.js";
 import { BENCHMARK_PROJECT_PROFILES_PATH } from "./scenarioCatalog.js";
 import { resolveIncrementalChangeStalenessScenarios } from "./scenarioSelection.js";
 export const INCREMENTAL_CHANGE_STALENESS_PLUGIN_ID = "incremental-change-staleness";
@@ -21,13 +21,39 @@ export const INCREMENTAL_CHANGE_STALENESS_RUN_OWNER_MARKER = ".incremental-chang
 export const incrementalChangeStalenessMetadata = {
     id: INCREMENTAL_CHANGE_STALENESS_PLUGIN_ID,
     name: "Incremental Change Staleness",
-    description: "Compares stale-index and full-refresh my-dev-kit retrieval after the same frozen controlled source change: matched correctness, required-file evidence, and a conservative stale-risk classification.",
+    description: "Compares no refresh, my-dev-kit changed-files incremental refresh, my-dev-kit affected-neighborhood incremental refresh, and full refresh after the same deterministic controlled source change. Comparisons are scoped to the observed evidence (correctness and required-file presence); full refresh is a reference treatment, not an asserted winner, and a partial treatment may truthfully fall back to a full rebuild.",
     schemaVersion: "1.0.0",
     status: "experimental",
     supportedTargets: ["self"],
     supportedOutputs: ["json", "html"]
 };
+export const CHANGED_FILES_REFRESH_VARIANT_ID = "changed-files-refresh";
+export const AFFECTED_NEIGHBORHOOD_REFRESH_VARIANT_ID = "affected-neighborhood-refresh";
+/** Public v0.6.3 treatments, in the fixed lifecycle order. Factual descriptions only; no treatment is called best or preferred. */
 const TREATMENT_VARIANTS = [
+    {
+        id: STALE_INDEX_VARIANT_ID,
+        name: "No refresh (stale index)",
+        description: "Keeps the pre-mutation baseline index and performs no post-mutation refresh."
+    },
+    {
+        id: CHANGED_FILES_REFRESH_VARIANT_ID,
+        name: "Changed-files refresh",
+        description: "Uses my-dev-kit's incremental changed-files refresh after the controlled mutation; upstream may truthfully fall back to a full rebuild."
+    },
+    {
+        id: AFFECTED_NEIGHBORHOOD_REFRESH_VARIANT_ID,
+        name: "Affected-neighborhood refresh",
+        description: "Uses my-dev-kit's affected-neighborhood incremental refresh after the controlled mutation; upstream may truthfully fall back to a full rebuild."
+    },
+    {
+        id: FULL_REFRESH_VARIANT_ID,
+        name: "Full refresh",
+        description: "Builds a complete post-mutation index and uses it as the comparison reference."
+    }
+];
+/** The released v0.6.2 two-treatment variants, kept only for the historical V1 run mapper. */
+const V1_TREATMENT_VARIANTS = [
     {
         id: STALE_INDEX_VARIANT_ID,
         name: "Stale index",
@@ -78,7 +104,7 @@ export const incrementalChangeStalenessPlugin = {
     metadata: incrementalChangeStalenessMetadata,
     defaultConfig: defaultIncrementalChangeStalenessConfig,
     configDefinition: incrementalChangeStalenessConfigDefinition,
-    supportedVariants: [...INCREMENTAL_CHANGE_STALENESS_TREATMENT_IDS],
+    supportedVariants: [...INCREMENTAL_CHANGE_STALENESS_V2_TREATMENT_IDS],
     validateConfig: validateIncrementalChangeStalenessConfig,
     async run(context) {
         if (!context.target.isSelf) {
@@ -94,14 +120,14 @@ export const incrementalChangeStalenessPlugin = {
         const projectProfiles = await readBenchmarkProjectProfiles(path.resolve(context.toolRoot, BENCHMARK_PROJECT_PROFILES_PATH), context.toolRoot);
         const executions = [];
         for (const resolved of resolvedScenarios) {
-            const lifecycle = await prepareIncrementalChangeStalenessScenarioLifecycle({
+            const lifecycle = await prepareIncrementalChangeStalenessScenarioLifecycleV2({
                 repoRoot: context.toolRoot,
                 runOwnedRoot,
                 scenario: resolved.scenario,
                 baseCase: resolved.baseCase,
                 kitCommand: context.config.kitCommand
             });
-            const execution = await executeIncrementalChangeStalenessScenario({
+            const execution = await executeIncrementalChangeStalenessScenarioV2({
                 repoRoot: context.toolRoot,
                 scenario: resolved.scenario,
                 lifecycle,
@@ -113,15 +139,15 @@ export const incrementalChangeStalenessPlugin = {
             executions.push(execution);
         }
         const outDir = context.outputRoot ?? path.resolve(context.toolRoot, context.config.outDir);
-        const artifact = buildIncrementalChangeStalenessExecutionArtifact({
+        const artifact = buildIncrementalChangeStalenessExecutionArtifactV2({
             runId: context.runId,
             pluginId: INCREMENTAL_CHANGE_STALENESS_PLUGIN_ID,
             executions
         });
         // The artifact is written before the framework's separate `cleanup` phase runs, so it is
         // written before the run-owned ephemeral index/target state is ever destroyed.
-        const artifactPath = await writeIncrementalChangeStalenessExecutionArtifact(outDir, artifact);
-        return mapIncrementalChangeStalenessExecutionsToRun({
+        const artifactPath = await writeIncrementalChangeStalenessExecutionArtifactV2(outDir, artifact);
+        return mapIncrementalChangeStalenessExecutionsToRunV2({
             runId: context.runId,
             startedAt,
             completedAt: new Date().toISOString(),
@@ -239,7 +265,7 @@ export function mapIncrementalChangeStalenessExecutionsToRun(args) {
         completedAt: args.completedAt,
         status,
         target: args.target,
-        variants: TREATMENT_VARIANTS.map((variant) => ({ ...variant })),
+        variants: V1_TREATMENT_VARIANTS.map((variant) => ({ ...variant })),
         cases,
         metrics: [
             { id: "incremental-change-staleness-scenario-count", name: "Scenario count", value: args.executions.length, unit: "count", description: "Selected scenarios in this run." },
@@ -272,3 +298,178 @@ export function mapIncrementalChangeStalenessExecutionsToRun(args) {
     run.summary = summarizeExperimentRun(run);
     return run;
 }
+// ---------------------------------------------------------------------------
+// v0.6.3 four-treatment mapping. Maps already-executed V2 evidence; recomputes nothing.
+// ---------------------------------------------------------------------------
+const UPSTREAM_REFRESH_METRIC_SPECS = [
+    { id: "upstream-refresh-fresh-extraction-file-count", name: "Upstream fresh-extraction files", field: "freshExtractionFileCount", description: "Files my-dev-kit freshly re-extracted during the refresh invocation (upstream execution evidence, not Lab task overlap)." },
+    { id: "upstream-refresh-reused-file-count", name: "Upstream reused files", field: "reusedFileCount", description: "Files my-dev-kit reused from the previous index during the refresh invocation (upstream execution evidence)." },
+    { id: "upstream-refresh-forced-neighbor-reanalysis-file-count", name: "Upstream forced-neighbor reanalysis files", field: "forcedNeighborReanalysisFileCount", description: "Neighbor files my-dev-kit forced to re-analyze during the refresh invocation (upstream execution evidence)." },
+    { id: "upstream-refresh-seed-file-count", name: "Upstream seed files", field: "seedFileCount", description: "Seed files my-dev-kit selected for the affected-neighborhood refresh (upstream execution evidence; absent when upstream reported none)." },
+    { id: "upstream-refresh-seed-symbol-count", name: "Upstream seed symbols", field: "seedSymbolCount", description: "Seed symbols my-dev-kit selected for the affected-neighborhood refresh (upstream execution evidence; absent when upstream reported none)." },
+    { id: "upstream-refresh-affected-node-count", name: "Upstream affected nodes", field: "affectedNodeCount", description: "Graph nodes my-dev-kit treated as affected during the refresh (upstream execution evidence, distinct from the Lab affected-neighborhood metrics)." },
+    { id: "upstream-refresh-affected-edge-count", name: "Upstream affected edges", field: "affectedEdgeCount", description: "Graph edges my-dev-kit treated as affected during the refresh (upstream execution evidence, distinct from the Lab affected-neighborhood metrics)." }
+];
+function upstreamRefreshMetrics(treatment, caseId) {
+    const refresh = treatment.refreshExecution;
+    if (refresh.kind !== "incremental")
+        return [];
+    const metrics = [];
+    for (const spec of UPSTREAM_REFRESH_METRIC_SPECS) {
+        const value = refresh.incrementalRefresh[spec.field];
+        // Null upstream fields are unavailable evidence, never a zero-valued metric.
+        if (typeof value === "number")
+            metrics.push(metric(spec.id, spec.name, spec.description, "count", value, treatment.treatmentId, caseId));
+    }
+    return metrics;
+}
+function comparisonMetadata(execution, treatmentId) {
+    const comparison = execution.referenceComparisons.find((entry) => entry.candidateTreatmentId === treatmentId);
+    if (!comparison)
+        return {};
+    if (comparison.kind === "stale-risk") {
+        return {
+            comparisonCorrectnessRelation: comparison.comparison.correctnessRelation,
+            comparisonRequiredFileEvidenceRelation: comparison.comparison.requiredFileEvidenceRelation,
+            staleRiskClassification: comparison.comparison.staleRiskClassification
+        };
+    }
+    return {
+        referenceComparisonCorrectnessRelation: comparison.correctnessRelation,
+        referenceComparisonRequiredFileEvidenceRelation: comparison.requiredFileEvidenceRelation,
+        referenceComparisonClassification: comparison.classification
+    };
+}
+function treatmentOutcomeV2(execution, treatmentId) {
+    const caseId = execution.scenarioId;
+    const treatmentIntent = INCREMENTAL_CHANGE_STALENESS_V2_TREATMENT_INTENTS[treatmentId];
+    const base = { id: `${caseId}:${treatmentId}`, caseId, variantId: treatmentId, artifacts: [] };
+    const treatment = execution.treatments.find((entry) => entry.treatmentId === treatmentId);
+    if (execution.status === "failed" || !treatment) {
+        return {
+            ...base,
+            status: "failed",
+            metrics: [],
+            warnings: [],
+            failures: [
+                {
+                    code: "incremental-change-staleness-scenario-failed",
+                    message: execution.failureReason ?? "Scenario execution failed before treatment evidence was produced.",
+                    variantId: treatmentId,
+                    caseId,
+                    recoverable: false
+                }
+            ],
+            metadata: { treatmentId, treatmentIntent, scenarioStatus: execution.status }
+        };
+    }
+    const status = treatment.status === "completed" ? "completed" : treatment.status === "failed" ? "failed" : "partial";
+    const refresh = treatment.refreshExecution;
+    const incremental = refresh.kind === "incremental" ? refresh.incrementalRefresh : null;
+    return {
+        ...base,
+        status,
+        metrics: [...treatmentMetrics(treatment, caseId), ...upstreamRefreshMetrics(treatment, caseId)],
+        warnings: treatment.retrievalStatus === "failed" || treatment.fakeAgent?.status === "failed"
+            ? [{ code: "incremental-change-staleness-treatment-partial", message: treatment.failureReason ?? "Treatment retrieval or fake-agent evaluation did not fully complete.", variantId: treatmentId, caseId }]
+            : [],
+        failures: [],
+        metadata: {
+            treatmentId,
+            treatmentIntent,
+            activeIndexPhase: treatment.activeIndexPhase,
+            treatmentStatus: treatment.status,
+            retrievalStatus: treatment.retrievalStatus,
+            fakeAgentStatus: treatment.fakeAgent?.status ?? "not-run",
+            requiredFileEvidenceStatus: treatment.requiredFileEvidence.status,
+            affectedNeighborhoodRelationship: treatment.affectedNeighborhood.relationship,
+            affectedNeighborhoodReindexRecommendation: treatment.affectedNeighborhood.reindexRecommendation,
+            refreshKind: refresh.kind,
+            refreshRealization: refresh.realization,
+            // Upstream categorical evidence only for incremental treatments; never invented for the others.
+            ...(incremental
+                ? {
+                    requestedScope: incremental.requestedScope,
+                    appliedScope: incremental.appliedScope,
+                    selectionStatus: incremental.selectionStatus,
+                    fallbackReason: incremental.fallbackReason
+                }
+                : {}),
+            ...comparisonMetadata(execution, treatmentId)
+        }
+    };
+}
+function countByRealization(executions, treatmentId, realization) {
+    return executions.filter((execution) => execution.treatments.find((treatment) => treatment.treatmentId === treatmentId)?.refreshExecution.realization === realization).length;
+}
+export function mapIncrementalChangeStalenessExecutionsToRunV2(args) {
+    const cases = args.executions.map((execution) => {
+        const partialClass = (candidate) => {
+            const comparison = execution.referenceComparisons.find((entry) => entry.candidateTreatmentId === candidate);
+            return comparison && comparison.kind === "partial-refresh" ? comparison.classification : null;
+        };
+        const stale = execution.referenceComparisons.find((entry) => entry.candidateTreatmentId === "stale-index");
+        return {
+            id: execution.scenarioId,
+            name: `${execution.scenarioId} (${execution.category})`,
+            // Exactly four outcomes per scenario, in the fixed lifecycle order (never a "raw" outcome).
+            outcomes: INCREMENTAL_CHANGE_STALENESS_V2_TREATMENT_IDS.map((treatmentId) => treatmentOutcomeV2(execution, treatmentId)),
+            metadata: {
+                category: execution.category,
+                benchmarkProject: execution.benchmarkProjectId,
+                baseCaseId: execution.baseCaseId,
+                scenarioStatus: execution.status,
+                staleRiskClassification: stale && stale.kind === "stale-risk" ? stale.comparison.staleRiskClassification : null,
+                changedFilesReferenceClassification: partialClass("changed-files-refresh"),
+                affectedNeighborhoodReferenceClassification: partialClass("affected-neighborhood-refresh")
+            }
+        };
+    });
+    const outcomeStatuses = cases.flatMap((experimentCase) => experimentCase.outcomes.map((outcome) => outcome.status));
+    const status = outcomeStatuses.length > 0 && outcomeStatuses.every((value) => value === "failed")
+        ? "failed"
+        : outcomeStatuses.every((value) => value === "completed")
+            ? "completed"
+            : "partial";
+    const count = (id, name, value, description) => ({ id, name, value, unit: "count", description });
+    const run = {
+        runId: args.runId,
+        pluginId: INCREMENTAL_CHANGE_STALENESS_PLUGIN_ID,
+        startedAt: args.startedAt,
+        completedAt: args.completedAt,
+        status,
+        target: args.target,
+        variants: TREATMENT_VARIANTS.map((variant) => ({ ...variant })),
+        cases,
+        metrics: [
+            count("incremental-change-staleness-scenario-count", "Scenario count", args.executions.length, "Selected scenarios in this run."),
+            count("incremental-change-staleness-observed-regression-count", "Observed stale regression count", args.executions.filter((execution) => {
+                const stale = execution.referenceComparisons.find((entry) => entry.candidateTreatmentId === "stale-index");
+                return stale?.kind === "stale-risk" && stale.comparison.staleRiskClassification === "observed-stale-regression";
+            }).length, "Scenarios whose no-refresh treatment was classified observed-stale-regression against full refresh."),
+            count("incremental-change-staleness-changed-files-applied-partial-count", "Changed-files applied-partial count", countByRealization(args.executions, "changed-files-refresh", "APPLIED_PARTIAL"), "Scenarios where the changed-files refresh was applied as a partial refresh."),
+            count("incremental-change-staleness-changed-files-fallback-full-count", "Changed-files fallback-full count", countByRealization(args.executions, "changed-files-refresh", "FALLBACK_FULL"), "Scenarios where the changed-files refresh fell back to a full rebuild."),
+            count("incremental-change-staleness-affected-neighborhood-applied-partial-count", "Affected-neighborhood applied-partial count", countByRealization(args.executions, "affected-neighborhood-refresh", "APPLIED_PARTIAL"), "Scenarios where the affected-neighborhood refresh was applied as a partial refresh."),
+            count("incremental-change-staleness-affected-neighborhood-fallback-full-count", "Affected-neighborhood fallback-full count", countByRealization(args.executions, "affected-neighborhood-refresh", "FALLBACK_FULL"), "Scenarios where the affected-neighborhood refresh fell back to a full rebuild.")
+        ],
+        artifacts: [
+            {
+                id: "incremental-change-staleness-execution",
+                label: "Incremental-change-staleness execution evidence",
+                path: args.artifactPath,
+                kind: "artifact",
+                mimeType: "application/json",
+                description: "Per-scenario four-treatment execution, refresh-realization, and full-refresh reference-comparison evidence, without raw context bodies."
+            }
+        ],
+        warnings: [],
+        failures: [],
+        metadata: {
+            kitCommand: args.kitCommand,
+            scenarioIds: args.executions.map((execution) => execution.scenarioId),
+            executionArtifactPath: args.artifactPath
+        }
+    };
+    run.summary = summarizeExperimentRun(run);
+    return run;
+}

package/dist/src/experiments/plugins/incrementalChangeStaleness/treatmentSessionV2.js

@@ -0,0 +1,5 @@
+/**
+ * v0.6.3 in-memory (runtime-only) four-treatment lifecycle session schema version. This is NOT the
+ * persisted execution artifact; persistence is a later batch.
+ */
+export const INCREMENTAL_CHANGE_STALENESS_LIFECYCLE_SESSION_V2_SCHEMA_VERSION = "2.0.0";

package/dist/src/experiments/plugins/index.js

@@ -1,3 +1,4 @@
 export * from "./contextStrategyComparison/index.js";
+export * from "./contextWindowScaling/index.js";
 export * from "./incrementalChangeStaleness/index.js";
 export * from "./warmIndexReuse/index.js";

package/dist/src/experiments/plugins/warmIndexReuse/agentEvaluation.js

@@ -41,7 +41,7 @@ export async function evaluateWarmIndexFakeAgents(options) {
     }
     return result;
 }
-async function evaluateFakeSide(args) {
+export async function evaluateFakeSide(args) {
     const promptStrategy = SIDE_STRATEGIES[args.variantId];
     const base = { variantId: args.variantId, agentId: "fake-agent", promptStrategy };
     try {

package/dist/src/experiments/plugins/warmIndexReuse/warmIndexSession.js

@@ -5,7 +5,9 @@ import { loadAffectedNeighborhoodGraphEvidence } from "../../../evaluation/affec
 import { captureIndexSnapshot } from "../../../evaluation/indexSnapshot.js";
 /**
  * Builds the index once through the shared `buildMyDevKitIndex` owner. A build that reports
- * success but leaves no index directory is not treated as a prepared session.
+ * success but leaves no index directory is not treated as a prepared session. `mode` is optional
+ * and defaults to an ordinary full build; only callers that explicitly request an incremental
+ * build mode get one.
  */
 export async function prepareWarmIndexSession(options) {
     const build = await buildMyDevKitIndex(options);

package/dist/src/mobile/android/advancedSecurity/candidateEvidence.js

@@ -19,14 +19,21 @@ function buildCandidateEvidenceId(ruleId, location, fingerprint) {
     const locationPart = [location.path, location.line !== undefined ? `l${location.line}` : undefined, location.column !== undefined ? `c${location.column}` : undefined]
         .filter((part) => Boolean(part))
         .join(":");
-    return [ruleId, slug(locationPart), fingerprint.slice(0, 16)].join("--");
+    const payloadStart = fingerprint.indexOf(":") + 1;
+    return [ruleId, slug(locationPart), fingerprint.slice(payloadStart, payloadStart + 16)].join("--");
 }
 // Never accepts a raw secret value as a plain string parameter name to
 // discourage accidental logging at call sites — `rawValue` is redacted and
 // fingerprinted here, once, and the raw value is never stored on the
 // returned object.
 export function makeCandidateEvidence(input) {
-    const fingerprint = fingerprintCandidateValue(input.rawValue);
+    const fingerprint = fingerprintCandidateValue(input.rawValue, {
+        ruleId: input.ruleId,
+        sourcePath: input.location.path,
+        line: input.location.line,
+        column: input.location.column,
+        purpose: "candidate-evidence"
+    });
     const redactedPreview = redactedPreviewForCandidate(input.rawValue);
     const id = buildCandidateEvidenceId(input.ruleId, input.location, fingerprint);
     return {

package/dist/src/mobile/android/advancedSecurity/redaction.js

@@ -1,4 +1,5 @@
-import { createHash } from "node:crypto";
+import { scryptSync } from "node:crypto";
+import path from "node:path";
 import { stripUnsafeControlChars } from "../../../securityValidation/attackScenarios/exploitEvidence.js";
 // ---------------------------------------------------------------------------
 // v0.4.1 Batch 1 — redaction and fingerprint primitives for later Android
@@ -13,8 +14,8 @@ import { stripUnsafeControlChars } from "../../../securityValidation/attackScena
 // payload). Android candidate evidence has a different, narrower need: a
 // human reviewing a static-candidate finding benefits from a short prefix/
 // suffix so they can recognize *which* secret in their own source it is
-// without the full value ever being reconstructable — so this module adds
-// that prefix/suffix-preserving preview and a non-reversible fingerprint on
+// without retaining the full value — so this module adds that
+// prefix/suffix-preserving preview and a one-way fingerprint on
 // top of the shared control-character stripping, instead of creating a
 // second, competing full-redaction implementation.
 // ---------------------------------------------------------------------------
@@ -42,13 +43,21 @@ export function redactedPreviewForCandidate(input, options = {}) {
     const suffix = bounded.slice(-edgeLength);
     return `${prefix}${MASK}${suffix}`;
 }
-// Stable, non-reversible fingerprint for deduplication. Uses Node's built-in
-// sha256 (no new dependency). Distinct from redactedPreviewForCandidate: the
-// fingerprint is stored for dedup, the preview is stored for human review —
-// neither one can be used to recover the raw value.
-export function fingerprintCandidateValue(input) {
+// Deterministic, one-way evidence identity. Scrypt makes guessing more costly
+// than a fast hash, but low-entropy values are not cryptographically
+// unrecoverable. The context salt separates equivalent values at distinct
+// evidence locations without storing a secret salt or the raw value.
+export function fingerprintCandidateValue(input, context) {
     if (input === undefined)
         return "unavailable";
-    const hash = createHash("sha256").update(input, "utf8").digest("hex");
-    return `sha256:${hash}`;
+    const contextSalt = Buffer.from(JSON.stringify([
+        "my-dev-kit-lab/android-candidate-fingerprint/v2",
+        context.ruleId,
+        path.posix.normalize(context.sourcePath.replaceAll("\\", "/")),
+        context.line ?? null,
+        context.column ?? null,
+        context.purpose
+    ]), "utf8");
+    const derived = scryptSync(input, contextSalt, 32, { N: 16384, r: 8, p: 1, maxmem: 64 * 1024 * 1024 });
+    return `scrypt-v1:${derived.toString("hex")}`;
 }

package/dist/src/mobile/android/advancedSecurity/secretCandidates/analyzeSecretCandidates.js

@@ -51,7 +51,6 @@ export function analyzeSecretCandidateFile(targetRoot, file) {
     const fileKind = fileKindFor(file.relativePath);
     for (const block of matchPrivateKeyBlocks(file.content)) {
         const location = buildAndroidSourceLocation(targetRoot, file.absolutePath, { line: block.line });
-        const fingerprint = fingerprintCandidateValue(block.rawBlock);
         if (!block.terminated) {
             candidates.push(makeCandidateEvidence({
                 ruleId: "android-secret-private-key-candidate",
@@ -66,6 +65,12 @@ export function analyzeSecretCandidateFile(targetRoot, file) {
             }));
             continue;
         }
+        const fingerprint = fingerprintCandidateValue(block.rawBlock, {
+            ruleId: "android-secret-private-key-candidate",
+            sourcePath: location.path,
+            line: location.line,
+            purpose: "private-key-finding"
+        });
         findings.push(makeAndroidFinding({
             ruleId: "android-secret-private-key-candidate",
             title: `Private key material found (${block.headerLabel})`,
@@ -98,7 +103,12 @@ export function analyzeSecretCandidateFile(targetRoot, file) {
             }));
             continue;
         }
-        const fingerprint = fingerprintCandidateValue(match.rawValue);
+        const fingerprint = fingerprintCandidateValue(match.rawValue, {
+            ruleId: classification.ruleId,
+            sourcePath: location.path,
+            line: location.line,
+            purpose: `credential-finding:${classification.sensitiveDataCategory}`
+        });
         findings.push(makeAndroidFinding({
             ruleId: classification.ruleId,
             title: `Hardcoded ${match.identifier} literal found`,

package/dist/src/mobile/android/advancedSecurity/signingConfiguration/analyzeSigningConfiguration.js

@@ -149,7 +149,7 @@ export function analyzeModuleSigningConfiguration(targetRoot, gradleModule, buil
     const buildFileRelativePath = gradleModule.buildFilePath ?? modulePath;
     const buildFileAbsolutePath = path.join(targetRoot, buildFileRelativePath);
     const location = loc(targetRoot, buildFileAbsolutePath);
-    const signingConfigs = extractSigningConfigurations(buildFileText);
+    const signingConfigs = extractSigningConfigurations(buildFileText, { sourcePath: location.path });
     const literalCredentialConfigNames = new Set();
     for (const config of signingConfigs) {
         const storePasswordResult = analyzeCredential("storePassword", config.storePassword, config.name, modulePath, location, buildFileRelativePath);

package/dist/src/mobile/android/advancedSecurity/signingConfiguration/extractSigningConfigurations.js

@@ -44,17 +44,17 @@ function extractStoreFileValue(content) {
         return { state: "literal", literalValue: fileWrapped[1] };
     return extractPathValue(content, ["storeFile"]);
 }
-function extractCredentialValue(content, keys) {
+function extractCredentialValue(content, keys, context) {
     const result = extractLiteral(content, keys);
     const state = classifyExpressionState(result);
     if (state === "literal" && result.value !== undefined) {
-        return { state, redactedPreview: redactedPreviewForCandidate(result.value), fingerprint: fingerprintCandidateValue(result.value) };
+        return { state, redactedPreview: redactedPreviewForCandidate(result.value), fingerprint: fingerprintCandidateValue(result.value, context) };
     }
     if (result.raw !== undefined)
         return { state, rawExpression: boundedRawExpression(result.raw) };
     return { state: "missing" };
 }
-function extractSigningConfigEntry(name, content) {
+function extractSigningConfigEntry(name, content, sourcePath) {
     const v1 = extractBooleanLiteral(content, ["enableV1Signing", "v1SigningEnabled"]);
     const v2 = extractBooleanLiteral(content, ["enableV2Signing", "v2SigningEnabled"]);
     const v3 = extractBooleanLiteral(content, ["enableV3Signing", "v3SigningEnabled"]);
@@ -62,9 +62,9 @@ function extractSigningConfigEntry(name, content) {
     return {
         name,
         storeFile: extractStoreFileValue(content),
-        storePassword: extractCredentialValue(content, ["storePassword"]),
+        storePassword: extractCredentialValue(content, ["storePassword"], { ruleId: "android-signing-password-literal", sourcePath, purpose: `signing-credential:${name}:storePassword` }),
         keyAlias: extractPathValue(content, ["keyAlias"]),
-        keyPassword: extractCredentialValue(content, ["keyPassword"]),
+        keyPassword: extractCredentialValue(content, ["keyPassword"], { ruleId: "android-signing-password-literal", sourcePath, purpose: `signing-credential:${name}:keyPassword` }),
         enableV1Signing: v1.value,
         enableV2Signing: v2.value,
         enableV3Signing: v3.value,
@@ -73,9 +73,9 @@ function extractSigningConfigEntry(name, content) {
 }
 // Extracts every named entry inside a module build file's `signingConfigs { }`
 // block. Returns an empty array (never throws) when no such block exists.
-export function extractSigningConfigurations(rawBuildFileText) {
+export function extractSigningConfigurations(rawBuildFileText, context) {
     const text = stripComments(rawBuildFileText);
     return extractNamedSubBlocks(text, "signingConfigs")
-        .map(({ name, content }) => extractSigningConfigEntry(name, content))
+        .map(({ name, content }) => extractSigningConfigEntry(name, content, context.sourcePath))
         .sort((a, b) => a.name.localeCompare(b.name));
 }

package/dist/src/plots/buildContextWindowScalingPlotData.js

@@ -0,0 +1,96 @@
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { CONTEXT_WINDOW_SCALING_EXECUTION_ARTIFACT_FILE } from "../experiments/plugins/contextWindowScaling/executionArtifact.js";
+import { parseContextWindowScalingExecutionArtifact } from "../experiments/plugins/contextWindowScaling/executionArtifactReader.js";
+import { aggregateContextWindowScaling } from "../experiments/plugins/contextWindowScaling/metrics.js";
+import { STANDARD_CONTEXT_BUDGETS } from "../experiments/plugins/contextWindowScaling/contextBudget.js";
+// ---------------------------------------------------------------------------
+// Context-window-scaling plot data. Maps values already calculated by
+// aggregateContextWindowScaling() (carried on ContextWindowScalingRun.aggregate) to plot
+// points. Nothing is recalculated; a null aggregate value becomes a skipped point, never 0.
+// ---------------------------------------------------------------------------
+export const CONTEXT_WINDOW_SCALING_PLOT_IDS = [
+    "context-window-scaling-context-size",
+    "context-window-scaling-success-rate-by-budget",
+    "context-window-scaling-correctness-by-budget",
+];
+export const CONTEXT_WINDOW_SCALING_SKIP_REASONS = {
+    contextSize: "context-size-unavailable",
+    successRate: "success-rate-unavailable",
+    correctness: "correctness-unavailable",
+};
+/** Standard budgets read as 8k/16k/32k/64k; any other budget keeps its exact integer form. */
+export function formatContextBudgetLabel(budget) {
+    return STANDARD_CONTEXT_BUDGETS.includes(budget) ? `${budget / 1024}k` : String(budget);
+}
+/**
+ * Returns the aggregate rebuilt from `<experimentDir>/context-window-scaling-execution.json`, or null
+ * when that artifact is absent. A present artifact is validated (schema version and structure) and
+ * aggregated by the canonical aggregateContextWindowScaling(); malformed input fails, never falls back.
+ */
+export async function readContextWindowScalingPlotSource(experimentDir) {
+    const artifactPath = path.join(experimentDir, CONTEXT_WINDOW_SCALING_EXECUTION_ARTIFACT_FILE);
+    if (!existsSync(artifactPath))
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(await readFile(artifactPath, "utf8"));
+    }
+    catch (error) {
+        throw new Error(`Invalid context-window-scaling execution artifact (${artifactPath}): not valid JSON (${error instanceof Error ? error.message : String(error)}).`);
+    }
+    const artifact = parseContextWindowScalingExecutionArtifact(parsed);
+    return {
+        aggregate: aggregateContextWindowScaling({ contextBudgets: artifact.contextBudgets, cases: artifact.cases }),
+        generatedAt: artifact.completedAt,
+    };
+}
+export function buildContextWindowScalingPlotData(args) {
+    const { aggregate } = args;
+    const skippedPoints = [];
+    const series = (id, title, xLabel, yLabel) => ({
+        id,
+        title,
+        xLabel,
+        yLabel,
+        kind: "scatter",
+        points: [],
+        warnings: [],
+    });
+    const contextSize = series(CONTEXT_WINDOW_SCALING_PLOT_IDS[0], "Raw vs Retrieved Context Size", "Case ordinal (canonical case order)", "Estimated context tokens");
+    const successRate = series(CONTEXT_WINDOW_SCALING_PLOT_IDS[1], "Success Rate by Context Budget", "Context budget (estimated tokens)", "Success rate (percent)");
+    const correctness = series(CONTEXT_WINDOW_SCALING_PLOT_IDS[2], "Correctness by Context Budget", "Context budget (estimated tokens)", "Mean correctness score");
+    const add = (plot, x, value, group, label, reason, metadata) => {
+        if (value !== null && Number.isFinite(value)) {
+            plot.points.push({ x, y: value, group, label, metadata });
+        }
+        else {
+            skippedPoints.push({ plotId: plot.id, label, reason });
+        }
+    };
+    // Case ordinal follows the aggregate's canonical case order (first appearance of each caseId).
+    const caseOrdinals = new Map();
+    for (const summary of aggregate.caseTreatmentContextSummaries) {
+        if (!caseOrdinals.has(summary.caseId))
+            caseOrdinals.set(summary.caseId, caseOrdinals.size + 1);
+    }
+    for (const summary of aggregate.caseTreatmentContextSummaries) {
+        add(contextSize, caseOrdinals.get(summary.caseId), summary.contextStatus === "available" ? summary.estimatedTokens : null, summary.variantId, `${summary.caseId} ${summary.variantId}`, CONTEXT_WINDOW_SCALING_SKIP_REASONS.contextSize, { caseId: summary.caseId });
+    }
+    for (const summary of aggregate.budgetTreatmentSummaries) {
+        const label = `${summary.variantId} ${formatContextBudgetLabel(summary.contextBudgetTokens)}`;
+        const metadata = { contextBudgetTokens: summary.contextBudgetTokens };
+        add(successRate, summary.contextBudgetTokens, summary.successRatePercent, summary.variantId, label, CONTEXT_WINDOW_SCALING_SKIP_REASONS.successRate, metadata);
+        add(correctness, summary.contextBudgetTokens, summary.meanCorrectnessScore, summary.variantId, label, CONTEXT_WINDOW_SCALING_SKIP_REASONS.correctness, metadata);
+    }
+    const plots = [contextSize, successRate, correctness];
+    const warnings = [];
+    for (const plot of plots) {
+        if (plot.points.length === 0) {
+            plot.warnings.push("No comparable data available.");
+            warnings.push(`${plot.title}: no comparable data available.`);
+        }
+    }
+    return { generatedAt: args.generatedAt, sourceExperimentDir: args.experimentDir, plots, skippedPoints, warnings };
+}

package/dist/src/plots/index.js

@@ -1,5 +1,6 @@
 export * from "./types.js";
 export * from "./buildExperimentPlotData.js";
 export * from "./buildWarmIndexPlotData.js";
+export * from "./buildContextWindowScalingPlotData.js";
 export * from "./renderSvgChart.js";
 export * from "./writePlotArtifacts.js";

package/dist/src/plots/writePlotArtifacts.js

@@ -1,6 +1,7 @@
 import { mkdir, writeFile } from "node:fs/promises";
 import path from "node:path";
 import { resolveWithinRoot } from "../core/pathSafety.js";
+import { buildContextWindowScalingPlotData, readContextWindowScalingPlotSource } from "./buildContextWindowScalingPlotData.js";
 import { buildExperimentPlotData } from "./buildExperimentPlotData.js";
 import { buildWarmIndexPlotData, readWarmIndexPlotSource } from "./buildWarmIndexPlotData.js";
 import { renderSvgChart } from "./renderSvgChart.js";
@@ -16,10 +17,18 @@ export async function writePlotArtifacts(options) {
     // A warm-index-reuse plugin output directory is detected by its plugin report; every other
     // directory keeps the legacy controlled-experiment plot path unchanged.
     const experimentDir = path.resolve(options.repoRoot ?? process.cwd(), options.experimentDir);
+    // A context-window-scaling directory is detected by its V1 execution artifact; evidence for more
+    // than one plugin family in the same directory is ambiguous and fails instead of choosing one.
+    const scalingSource = await readContextWindowScalingPlotSource(experimentDir);
     const warmSection = await readWarmIndexPlotSource(experimentDir);
-    const data = warmSection
-        ? buildWarmIndexPlotData({ section: warmSection, experimentDir })
-        : await buildExperimentPlotData({ experimentDir: options.experimentDir, repoRoot: options.repoRoot });
+    if (scalingSource && warmSection) {
+        throw new Error(`Ambiguous experiment directory for plots (${experimentDir}): it contains both context-window-scaling and warm-index-reuse evidence.`);
+    }
+    const data = scalingSource
+        ? buildContextWindowScalingPlotData({ aggregate: scalingSource.aggregate, experimentDir, generatedAt: scalingSource.generatedAt })
+        : warmSection
+            ? buildWarmIndexPlotData({ section: warmSection, experimentDir })
+            : await buildExperimentPlotData({ experimentDir: options.experimentDir, repoRoot: options.repoRoot });
     return writePlotArtifactsFromData({ data, outDir: options.outDir });
 }
 export async function writePlotArtifactsFromData(options) {